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1 Introduction 

Let L be a finite field. A function / : L — > L is said to be almost perfect nonlinear 
(APN) if the number of solutions in L of the equation 

f(x + a)-f(x) = b (1) 

is at most 2, for all a, b £ L, a ^ 0. If the number of solutions of ([T]) in L is at most 5, we 
say / is differentially 5-uniform. Thus APN is the same as differentially 2-uniform. A 
differentially 1-uniform function is also called a perfect nonlinear function, or a planar 
function; however, these do not exist in characteristic 2 because in that case if a; is a 
solution of {T}, so is x + a. In this paper we only consider finite fields of characteristic 
2. 

The classical example of an APN function is f(x) — x 3 , which is APN (over any 
field) because ([T]) is quadratic. These were generalized to the Gold functions f(x) = 
x 2 + 1 , which are APN over ¥2^ if (n,r) = 1. 

APN functions were introduced in [7] by Nyberg, who defined them as the mappings 
with highest resistance to differential crypt analysis. Since then many papers have been 
written on APN functions, although not many different families of such functions are 
known. For some time the list of known (extended affine) inequivalent APN functions 
comprised only monomial functions and was conjectured to be complete. Since 2006 
several new families of non-monomial APN functions have been discovered. Two bino- 
mial families are presented in Budaghyan-Carlet-Leander [3]. Two infinite families, one 
of which generalizes the binomial family, were discovered in [2]. One of these families 
consists of the trinomials in Equation ([2]| below, which we will study in Sections [5] and 

m 

An important aspect of this problem, after establishing the APN property is to 
check that the functions are really new, i.e. that they are inequivalent to the known APN 
families. The notions of equivalence most pervasive in the current literature are extended 
affine (EA) and Carlet-Charpin-Ztnoviev (CCZ) equivalence [JJ. EA-equivalence is finer 
than CCZ- equivalence and is usually somewhat easier to establish. 

Two functions f,g : L — > L are called EA-equivalent if there exist affine permu- 
tations A\,A2 and an affine map A such that g — A\ o / o A2 + A. The differential 
uniformity of a function is an invariant of EA-equivalence. However, a bijective func- 
tion is not necessarily EA-equivalent to its inverse, even though they have the same 
differential uniformity. 

Two functions are called CCZ-equivalent if the graph of one can be obtained from 
the graph of the other by an affine permutation of the product space. Differential unifor- 
mity and resistance to linear and differential attacks are invariants of CCZ-equivalence, 
and unlike EA-equivalence, any permutation is always CCZ-equivalent to its inverse. 

In the instance that a function / : L — ► L is quadratic, the map f(x + y) + f{x) + 
f(y) is bilinear. Therefore, the problem of testing the APN property of / is reduced to 
obtaining an estimate on the size of the kernel of the linear map f(x + a) + f(x) + f(a). 
For this reason, most of the known non-monomial APN functions are in fact quadratic. 

It turns out that in the case of quadratic functions the problem of establishing 
CCZ equivalence can sometimes be reduced to checking EA-equivalence. Yves Edel 
has asked recently in some conference presentations whether any two quadratic APN 
functions are CCZ-equivalent if and only if they are EA-equivalent. The main result 
of this paper is a partial answer: we prove that a quadratic APN function is CCZ- 
equivalent to a Gold function if and only if it is EA-equivalent to that Gold function. 
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Up to now, proofs that CCZ-equivalence implies EA-equivalence have been by lengthy 
brute force computations for specific functions; see the proof of Theorem 4 in [3], for 
example. Our result is more general, holding for any quadratic function, and the proof 
is by different methods. Our methods will involve a study of the automorphism group 
of a code determined by a quadratic function. For the Gold functions, this group is 
known and has been determined by Berger pQ. We combine our main result with a 
study of the automorphism group to show that a new family of APN functions found 
by Bracken-Byrne-Markin-McGuire are CCZ inequivalent to any Gold function. This 
family is a subclass of that given in [2] and has the following description. Let k and 
s be odd coprime integers, let 6, c £ F 2 2f= with c ^ F 2 fc , and b a primitive element of 
F 2 2fc . The polynomials of the form 

r r \ i 2 S + 1 . 2 s + l\2 fc . 2 k + l /0 n 

f s (x) = bx + (bx T ) + cx (2) 

are APN on F 2 2f= . Previously, these polynomials were demonstrated in [2] to be in- 
equivalent in general to x 2 +l by using a computer to show the result for k — 3 and 
k = 5. 

This paper is organized as follows. In Section[2]we discuss some general background, 
including the important connections between an APN function and a certain associated 
code. Section[3]discusses the particular case of quadratic APN functions, and introduces 
the property we use in this paper. In Section U we present our main result, which 
proves that any quadratic APN function that is CCZ-equivalent to a Gold function 
must be EA-equivalent to that Gold function. Section [5] proves some results about 
automorphisms of family of APN functions in Equation @, and Section [5] applies the 
results of the paper to that family. 

2 Equivalence of APN functions and codes. 

Throughout the paper we fix a finite field K := F 2 « of characteristic 2. Let Tr denote 
the absolute trace map from K to F 2 . We write F| = ¥^ , implicitly fixing an ordering 
of K. To a function / : K — > K we associate a linear code Cf < F 2 = F^ as 

C f-= {^ a ,0, e \^P€K,e€¥ 2 } 

where 

c S afi e :K^¥ 2 ,x^ Ti(ax) + Tr(pf(x)) + e. 

It was first observed in [3] that the dual code of Cf has minimum distance 6 if and 
only if / is APN. Also [2] Thm. 6] (first stated by John Dillon in a talk given at Banff 
in 2006 and later in [5]) shows that two functions /, g are CCZ-equivalent if and only 
if the associated linear binary codes Cf and C g are equivalent. Recall that two codes 
C,D < F^ are equivalent, if there is some permutation n g Sn of the coordinate places 
with tt(C) = D. Explicitly, 

<C) = {c f a p e -K\a,p eK,ee¥ 2 } 

where 

c f a g £ tt = x M> Tr(axn) + Tr(/3/(a;7r)) + e. 
The automorphism group of a code C is defined as 

Aut(C) := {tt e S N | 7r(C) = C}. 
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Remark 1 Identifying the places of the codes with the elements of K, we obtain certain 
canonical permutation groups: 

(a) E := (K, +), the additive group of K, isomorphic to acting regularly on K by 
a : K — > K, x t- > a + x. 

(b) M := K* , the multiplicative group of K, isomorphic to Z2"_i acting on K by 
a : K — > K, x t-¥ ax. Note that K* fixes and acts regularly on K \ {0}. 

(c) r := Gal(if/F2) = (cr) = Z ra , the Galois group of K acting on K as the Frobenius 
automorphism a : K — > K, x \-t x 2 . 

This paper mainly treats the important class of quadratic APN functions / : K — > 
K. Recall that the polynomial / G K[x] is quadratic if for any non-zero k £ K, the 
function f(x + k) + f{x) + f(k) is a linearized polyomial in x, or equivalently, if it is 
F2-linear. The family of trinomials ([2} is quadratic, as is x 2 + . 

The following proposition is well known - it states that the additive group of the 
field is contained in the automorphism group of a quadratic function. 

Proposition 1 Let f : K — > K be quadratic. Then (K, +) < Aut(C^). 

Proof Since / is quadratic, for each k £ K we may write L(x + k) := f(x + k) + f(x) + 
f(k) = kiX 2 for some ki £ K. Using this and that fact that Tr(a) = Tr(a 2 ) for 
each a £ K we obtain: 

7i "fc( c l / 3,c( a; )) = c L,p,S x + k ) 

= Tr(a(a; + k)) + Tr(/3f(x + k)) + e 

= Tr{ax) + Tt(J3{L{x + k) + f(x) + f(k))) + Tr(afc) + e 

= Tr(ax) + Tr(@L(x + k)) + Tr(/3f(x)) + Tr(/3/(fc)) + Tr(afc) + e 

= Tr(ax) + Tr^Gafci) 2- ' x) + Tr(fif(x)) + Tr(/3/(fc)) + Tr(afc) + e 

i 

— C . a Ax) 

where a' = a + J2i(P k i) 2 ~ % and e ' = 6 + Tr (- fl /( fc )) + Tr(afc). It follows that the map 

TT k : C f — > C f : c f aJ3 Jx) ^ c f a p e {x + k) 
is an automorphism of Cf. 

□ 

We recall some basic definitions from group theory. Further background reading 
may be read in [S] 

Definition 1 Let G be a group and let H, N be subgroups of G, with iV normal. 

1. The normalizer of H in G, denoted Nq(H), is the subgroup of G comprising all 
g £ G such that gHg^ 1 = H . 

2. The centralizer of H in G, for which we write Cq(H) is the subgroup of G com- 
prising all g £ G such that ghg^ 1 = ft for all h £ H . 

3. If AT fl H is the identity then the group NH is called the semi-direct product of N 
and i/ and we write iV : H. 
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For the remainder, we will write A := Ng 2 „ (K, +) to denote the normalizer of 
(K, +) in the symmetric group on 2 n elements. 

This normalizer A plays the key role in establishing EA-equivalence via Theorem 
Q] below. 

Proposition 2 The normalizer A of (K, +) in the symmetric group is the full affine 
group. That is, 

A = (K, +) : GL„(F 2 ) s (ZJ) : GL„(F 2 ). 

Proof Since conjugation is a group automorphism, we obtain a group homomorphism 
from the normalizer into the automorphism group 

K : A -t Aut(K, +) ^ GL„(F 2 ), ?r^(eH nen^ 1 ). 

Clearly, the kernel of k is the centralizer Cg 2n (K, +) of (K, +) in £>2 n an d so A/ Gg 2 „ [K, +) = 
GL n (F 2 ). Now (K, +) acts regularly on itself via 7rj, : x h-s> t + fc. We claim that 
Cs 2n (K,+) = (K, +). It is clear that (K, +) C Cs 2 „(i ; f,+), since is abelian. 

To see the converse inclusion let 9 £ Cg 2n (K, +). Composing 9 with the inverse of the 
permutation 7rg(Q) £ (K, +) we may assume that 7r(0) = 0. By assumption, 9 = -Ky.9-K_y, 
for all k £ K and hence (9(a;) = 8(x — k) + k for all x,k £ K. In particular this gives 
6(k) — k for all k, so that # is the identity. We deduce that Cg 2 „(K,+) = (K, +). 
The elements in GL n (F2) stabilize £ K, hence (K,+) meets GL n (F2) at the iden- 
tity and we conclude that the normalizer A is the semidirect product as given in the 
proposition. 

□ 

Remark 2 The group A is also the automorphism group, A = Aut(Co), of the first- 
order Reed-Muller code (see [1 Ch. 13, Sec. 9]) 

Co = {c Q , ,e | a £ K,e £ F 2 }. 

The next 'folklore' result is an important reformulation of EA-equivalence in terms 
of codes. To our knowledge a proof has not appeared in literature. We include a proof 
here for completeness. 

Theorem 1 A acts on {C* \ f : K —¥ K}. Functions f and g are EA-equivalent 
functions if and only if the codes C f and Cg are in the same A-orbit. 

In the proof it will be convenient to work with generator matrices. Let iV := 2" 
denote the length of the code Ct. By a generator matrix G for Cf we mean a matrix 
G with row-space Ct. Choosing an F2-basis (b\, . . . , b n ) of K we obtain a generator 
/ 1 \ 

matrix of the form G = I G' I where 1 £ {l} lxN denotes the row consisting of 1 
\GfJ 

only and Gq, Gf £ F^ xN are defined by indexing the columns with the elements of K 
as 

(Go^^Tr^x), (G f ) i}X :=Tr(bif(x)). (*) 

Note that Go :=[„/]€ IfK"^ 1 '*^ is a generator matrix for the first-order Reed- 

Muller code G . 

The following Lemma is of independent interest. 
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Lemma 1 Let f,g : K K. Then Cf = Cg if and only if g = A\ o / + A for some 
affine 'permutation A\ and some affine map A. 











j and G' = j 











above. Then Cf = C g if and only if G and G have the same rowspace, if and only if 
there are B 1 G GL„(F 2 ), B G F" x ", t G F' 2 IX 1 such that 

Gg = B 1 G f + BG' + tl. 

By (*) above, this means that for all x G K and all 1 < i < n 

Tr(b ig (x)) = Tr(Bibif(x)) + Tr(Bb lX ) + U 

and hence g = A\ o / + A with A 1 = (Bi d , 0) and A = (B ad ,t) where a ad denotes the 
adjoint linear map of a with respect to the trace bilinear form. A similar calculation 
shows the converse. 

□ 

Proof of Theorem [T] (1) We first show that 

{Cf \ f : K —¥ K} — {C < Ff | C C C, dim(C*) < 2n + 1}, 



and in particular that A = Aut(Co) acts on this set. 
The inclusii 
Cq and let 



The inclusion C is clear. So let C < F^" be a code of dimension < 2n + 1 that contains 



G = " 6 F 



G 



Go\ 1K ,(2n+l)xJV 



- 2 



be a generator matrix of C. Let T G F 2 denote the Gram matrix of the basis 
(&1, . . . , b n ) of K with respect to the trace bilinear form, 

T i,j = Tr(&i&j). 

Then T G GL„(F2) by the non degeneracy of the trace. For x G K let f x denote the 
column of index x of T -1 Gi and define / : K — > K by /(a;) := $ji=i £ ^ the 
corresponding element in _K". Then G\ = Gt and hence C = Cf. 

(2) Now let f,g : K K be EA-equivalent, so there are affine permutations Ai,A2 
and an affine mapping A such that g = {A\ o / o A 2 ) + A. We have to show that C g 
and are in the same orbit under A. By Lemma [1] we may assume that A\ = 1 and 
A = and hence that g — f o A 2 for some A 2 G (A", +) : GLp 2 (A") = A. This means 
that g(x) — /(A 2 (a;)) and A 2 induces a permutation of the places x G K that are in 
A. 

(3) Finally we prove the converse implication. Assume that there is some 7r G A such 

that Cj = 7r(Cg). Let G = I G I be the generator matrix of C g as above. Then 

\G 9 J 

n(C g ) = Cf has a generator matrix 
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obtained by multiplying G with the permutation matrix tv from the right. Since -n fixes 



the code G , there is A G GL n (F 2 ) and t 6 F 2 

Gq7T = AGq 



•nxl 



Therefore there are matrices t x € F^ xl ,Si eF"" 



such that 
tl. 

,Ai e GL„(F 2 ) s.t. 



/I 



\*3 



.4 



Si 



Gn7T 



^1/ \<W 




reading as 



Gy = AiGg-K + BiGq + til = G Al0gow+ ( Bl<tl y 

Since 7r is an affine permutation, and is an affine mapping this yields that 

/ = Ai o g o 7T + (Bi , ti) is EA-equivalent to g. □ 



3 Quadratic APN functions 

We now consider quadratic APN functions h satisfying the property that all regular ele- 
mentary abelian subgroups of Aut(C^) are conjugate to (K, +). We will show that such 
functions satisfy Edel's conjecture, i.e., that CCZ-equivalence for this family implies 
EA-equivalence. In fact the APN property is not required in what follows. However, 
our interest in CCZ-equivalence is usually restricted to the class of APN functions. 

Theorem 2 Let h be a quadratic function such that E := (K,+) < Aut(G/j) =: H < 
. Assume that for all n G S2" 

nEn^ 1 < H there is some h^ £ H such that nEn' 1 = h^Eh^ 1 . 

If a quadratic function f is CCZ-equivalent to h then it is also EA-equivalent to h. 

Proof Since / and h are CCZ-equivalent, there is 7r € 5*2" such that 7r(Cj) = C/j. The 
subgroup E < Aut(Gj) is hence conjugated to nEn^ 1 < Aut(G^). By assumption this 
implies that K^ 1 ti normalizes E, and hence 7r £ Ng 2Tl (E) = A and h^ 1 n(Cf) = 
/i~ 1 (C? l ) = Cfy. By Theorem [1] this means that the two functions are EA-equivalent. 

□ 

Since all regular elementary abelian subgroups are conjugate in 5 2 i , the following 
corollary is a reformulation of the theorem above and suggests one strategy to prove 
Edel's conjecture for arbitrary quadratic APN functions. 

Corollary 1 Let h be a quadratic function such that all regular elementary abelian 
subgroups o/Aut(G/j) are conjugate to (K,+). Then all quadratic functions f that are 
CCZ-equivalent to h are indeed EA-equivalent to h. 

Thus Edel's conjecture for APN functions is proved under the stated hypothesis 
of Corollary [T] We do not know any quadratic APN functions h for which the above 
property does not hold, i.e., for which Aut(G/j) contains more than one conjugacy 
class of regular elementary abelian subgroups. We checked that it holds for all known 
APN functions of degree up to 7. Note that this is not true for arbitrary functions, 
for example, linear functions / have Aut(Gy) equal to the affine linear group, which 
usually has several different conjugacy classes of elementary abelian subgroups of order 
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4 Quadratic functions equivalent to the Gold function 

Well understood examples of quadratic APN functions are the Gold functions 

g : K K, x i-> x 2 ^ 1 

for a fixed positive integer r satisfying (r, n) = 1. The automorphism group Q of C g 
contains some obvious automorphisms: the additive group of the field, the multiplicative 
group of the field, and the Galois automorphisms. Results of Berger J] show that this 
is the full automorphism group, i.e., 

G := Aut(Cg) ^ (K,+) : K* : Gal(K/W 2 ) = EMF 

(in the notation of Remark[T) of order \g\ = \E\ ■ \M\ ■ \r\ = 2™(2" - l)n. The proof 
uses the classification of finite simple groups. 
We recall some basic definitions. 

Definition 2 Let G be a finite group and let if be a subgroup of G. We say that H 
is a p-subgroup of G if H has order p r for some positive integer r. H is called a Sylow 
p-subgroup of G if r is the greatest positive integer such that p r divides \G\. 

The well-known second Sylow theorem states that all Sylow p-subgroups of a group 
G are conjugate in G. Since any subgroup that is normal in G forms its own conjugacy 
class, as a direct consequence of this Sylow theorem we have that if H is a normal 
Sylow p-subgroup of G then it is the unique subgroup of G of that order. 

Lemma 2 (K, +) is the unique subgroup of g that is isomorphic to E;. 

Proof This is clear, if n is odd, since then 2™ is the largest 2-power in \g\ and (K, +) 
is a Sylow 2-subgroup of (J, which must be unique since (K, +) is normal in g and all 
such Sylow 2-subgroups are conjugate. 

Assume now that n — 2k is even and let T = 1^ be an elementary abelian subgroup 
of g. Then any x G T satisfies x 2 — 1 so in particular x 2 £ (K, +). Therefore T is 
a subgroup of S := (K,+) : (r) = {x £ g \ x 2 e (K, +)}, where r = a k : z M> 
z 2 £ Gal(if/F2) is the Galois automorphism of order 2. It is easy to check that the 
centralizer of r in S is isomorphic to (F 2 i- , +) x (r), which has order 2 fe+1 . Now consider 
the natural epimorphism S — ¥ S/ (K, +) = (r) and assume that the elementary abelian 
subgroup T < S is not contained in the kernel of this map (i.e. assume that T is not 
equal to K). Then there exists some s G (K, +) such that sr £ T. Now T is abelian 
and is generated by sr and T n K. Therefore TDK has index 2 in T and so has order 
jT|/2 = 2 2fe ~ 1 . Let £ T n K. Then st6 = 6st = s6t, and hence 9 commutes with r. 
This shows that TMC C C s (r). But then 2 2k ~ 1 = |Tn JC| < \C S (t)\ = 2 fe+1 < 2 2fe_1 , 
giving a contradiction. We deduce that T = (A", +), and hence (K, +) is the unique 
elementary abelian subgroup of order 2 2k of g. 

a 

The main result of this paper, stated below, follows now from Lemma[2]and Corol- 
lary Q] 

Theorem 3 Let f be a quadratic APN function and g be a Gold function. If f and g 
are CCZ- equivalent, then they are EA-equivalent. 
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Corollary 2 Let h be a quadratic APN function such that Aut(C^) is isomorphic to 
a subgroup ofQ. Then all quadratic APN functions f that are CCZ- equivalent to h are 
indeed EA-equivalent to h. 

Regarding a proof of Edel's conjecture, we may indeed hope that the automorphism 
group of any quadratic APN function is contained in Q. If this were true, proving it 
would complete a proof of Edel's conjecture, thanks to Corollary [2] However, this is 
not true: 

Example 1 Consider the quadratic functions given in [5] . 

ht := x 3 + x 5 + u 62 x 9 + u 3 x w + x 18 + u 3 x 2a + u 3 x 34 + x i0 , 
h 2 := x 3 + u U x 5 + u 13 x 9 + x 17 + u U x 33 + x 48 , 

and 

. 3 , 17 . 16/ 18 . 33x . 15 48 

/I3 := x + x + u (x + x ) + u X 

Then h% and h 2 are APN on GF(2 6 ) and \Aut(C hl )\ = |Aut(C, l2 )| = 2 6 .5, which is 
not a divisor of 2 6 (2 6 - 1)6. The polynomial h 3 is APN on GF(2 8 ) and Aut(C, l3 ) has 
order 2 10 .3 2 .5, which does not divide 2 8 (2 8 - 1)8. 

5 Automorphisms of Family ([2]) 

We could now use Theorem [3] directly to establish CCZ-inequivalence of a member 
of Family ((2)1 (or indeed any other quadratic) to the Gold functions by establishing 
EA-inequivalence, which can be achieved by a brute-force comparison of coefficients in 
the equation g = A\ o / o A 2 + A. 

Instead we find that further knowledge of the automorphism group associated with 
Family ((2} allows us to show that for this family, CCZ-equivalence with the Gold 
functions holds not merely if and only if the corresponding codes are equivalent (EA- 
equivalence) , but if and only if they are equal. Thus in this instance we can avoid 
applying brute- force. 

Let k, s be odd coprime integers, K = F 2 2k and L := F 2 k the subfield of K of 
index 2. We denote by T 2 : K — > L the relative trace of K to L. 

We compute a subgroup U of the automorphism group of the APN functions in 
Family @, which is big enough to allow us to prove that if a function / in Family ^ 
is EA-equivalent to a Gold function g, then Cf = C g . We remark that the particular 

form of / = T 2 {bx* ^) + cx z ^ is helpful in determining some of the automorphisms 
of Cf. Most other (known) APN functions do not have such a form, and determining 
their automorphisms seems to be difficult. 

It will be helpful to us to parametrize / by s and c £ K\L; we write 

, , , 2 s +l . /, 2 S + K2 fc . 2 fe +l 

/ = fc,s ■= fa t (K ) + cx T , 

for any b primitive in K. 

Since f c , s is an APN function, dim(C^ c J = 4fc + 1 (cf. g] Cor. 1]) and 

C fcs = (1) C © C c = (c , ,i) © {c Q ,o,o \a£K}® {c S QfjQ \PeK}. 
We claim the following. 
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Lemma 3 Any two c, d G K \ L define the same codes, i.e., C c = 
Proof For c 6 K \ L we have 

fc,s{x) = (bx ^ ) + (bx j + cx = T 2 (bx ) + cx . 

Note that for any x G K the element x 2 +1 lies in L. We have to show that the set 
{Cg a q | ft G -ft^} is independent of the choice of c. By the transitivity of the trace we 

obtain c^ ^x) = Tr L/F2 (T 2 (/3/ c , s (a;))) and 

T 2 (f3f c , s (x)) = T 2 (f3)T 2 (bx 2S + 1 ) + T 2 (/3c)x 2k+1 . 

Since the trace T 2 is nondegenerate and (1, c) as well as (1, d) form a basis of K over 
L, there is for any given pair (T 2 (/3), T 2 (f3c)) a unique p' £ K such that 

T 2 (P') = Tz{p) and T 2 {0 d) = T 2 (/3c). 

So the code C c is independent of the choice of c € A" \ L. 

□ 

Lemma 4 We have F| C Aut(C*/ c s ) . 

Proof Let u be a generator for F|. Since s and k are odd, the exponents 2 s + 1 and 
2 fc + 1 are both multiples of 3 and hence / CjS (ajx) = f c ,s{x). 

□ 

Lemma 5 VFe /lave L* C Aut(C*y c s ). 

Proof If z 6 L* it is easy to check that f c , s {zx) = z 2 +1 / cz i-2 s (x). All transformations 
involved do not change the code C f c s , using Lemma|31 So multiplication by a primitive 
element of L is an automorphism. 

□ 

Hence we obtain the following result: 

Theorem 4 Aut(Cj cs ) contains a subgroup U = {K, +) : (F| x L*) of order 2 2k ■ 
3(2 fc - 1). 

Note that Aut(Cj e s ) is not abelian, since the subgroup U we know about is not 
abelian. 

For s = 1 we obtain one more automorphism giving rise to a subgroup of order 
2 2k ■ 3fc ■ (2 fc - 1) of Aut(C/ e J- We conjecture that this is the actual order. This has 
been verified by computer for k — 3 and k = 5. 

Lemma 6 Aut(Cj e x ) has an element S of order 3k, such that S k = lu from Lemma^ 

Proof Choose c = fo( 2fc+1 )/ 3 . Then c G K\L and by Lemma0we may assume without 
loss of generality that / = f c \. It is easily checked that f c ,i(bx) is equal to o~ 2 (f(x)), 
where a is the Frobenius automorphism of K over F2. Letting Tb(f(x)) — f(bx), the 
map 8 := a~ 2 o T b is hence an automorphism of Cf c , and its order can be checked to 
be 3k. 

□ 

The automorphism groups of other families of APN functions do not appear to 
be as easy to work with as for Family @. Therefore we have not been able to prove 
similar results for other families. 
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6 Inequivalence. 

We apply the results of the previous sections to give a proof that Family Q functions 
are not CCZ-equivalent to Gold functions. 

Theorem 5 Let g : K — » K be a Gold-function and f : K — > K be an APN function 
in Family pify. If f and g are EA-equivalent, then the associated codes Cf and Cg are 
equal. 

For the proof of the theorem we need two lemmas, the first one is surely well-known. 
Recall that if a group G acts on a set X and a £ X then the stabilizer subgroup of a, 
denoted Stabc(a) is the set of elements of G that fix a. 

Lemma 7 JV GLn(Fa) (K*) = K* ■ Gal(JT/F a ). 

Proof Let G = N GIjnir ^(K*). Clearly K* < G = if*Stab G (l). So it is enough to 
show that the elements n £ G with 7r(l) = 1 are indeed field automorphisms of K 
and therefore contained in Gal(if/F2). Choose n £ G such that 7r(l) = 1. Since tt £ 
GL n (F2), the mapping tt acts linearly on the set K and hence respects the addition. 
We now show that 

7r(o6) = Tv(a)n(b) for all a,b £ K. 

To see this let a, ft £ K* C S n be such that q(1) = a, /3(1) = b. Since tt normalizes 
K* , also 

a := Tva-K~ l and j3 := -k/3-k^ 1 £ K* . 

We calculate n(a) — 7r(a(l)) = (7ra7r _1 )(l) = 5(1) and similarly 7r(6) = /3(1). Clearly 
ab = a(/3(l)) and 

n(ab) = (7ra/?7r _1 )(l) = 5(^(1)) = 7r(o)7r(&). 

□ 

Lemma 8 The group G from Lemma [?] contains a unique cyclic subgroup of order 
3(2 k -l). 

Proof All elements of G are of the form cry where a £ K* and 7 £ Gal^, F2). Assume 
that such an element 07 has order 3(2 fe — 1). Let £ be the order of 7. Then £ divides 
2k = £m and also the order of 07. We calculate 

(a-yf = N K/Fam (a) £ Fjm = Z^-v 

So 07 has order dividing £(2 m — 1) and we conclude that 

3(2 fe - 1) divides £(2 2k/i - 1) 

from which we obtain that £ = 1. 

□ 

Proof (of Theorem [5]l Assume that there is some n £ A with tt(C f) = Cg. We identify 
the places of the code with K. Since Aut(C g ) is 2-transitive on K (cf. [6]), we may 
assume without loss of generality that 



tt(0) = and tt(1) = 1 so tt £ GL„(F 2 ) = Stab^(O). 
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Moreover ir conjugates U < Aut(Cj) into Q — Aut(C g ), and since ir fixes 0, also 
Z 3(2*-l) = 7rStab w (0)7r _1 = tt(L* x F2)7r _1 < Stab g (0) = K* : G&\{K,W 2 ). 

By Lemma[8]this implies that n normalizes L* x F4 < K* . Since L* and F| generate K 
as an F2-algebra, the linear span of the matrices in L* x F| is equal to K — K* U {0} C 
jpnxn therefore n a i so normalizes K and hence K* , so n £ Gal(K, Fj) < 5 by Lemma 
[7| This proves the theorem since we have shown that any equivalence 7r between the 
codes and C g is indeed already contained in Aut(C 9 ). 

□ 

Theorem 6 C f ^C g . 

Proof Suppose that Cf = Cg. Then given any e £ ¥2, a, /3 £ K there exist e 6 F2, 
a , P £ K satisfying 

e + Tr(ax) + Tr(^(T 2 (6x 2S + 1 ) + cx 2 ^ 1 )) = e' + Tr(a'x) + Tr(/3'x 2r+1 )) 

for all x £ K, so in particular we must have e = e . Choose /3 £ L. Then we have 
Tr(/3(T 2 (te 2S+1 ))) = Tr(T 2 (/?fex 2S+1 )) = and so 

Tr(0 + a')x) = Tr(/3cx 2fc+1 ) + Tr(^'x 2r+1 ), 
for all x £ K. Using the linearity of the LHS we obtain 

Tr(l3c(x 2k a+xa 2 " (x r a+xa 2 ' )) = Tv((l3x 2k (c+c 2k ) + (p') 2 ~ r x 2 ~ r +/3' x 2 " )a) = 0, 

for all x,a £ K. This implies that (3x(c + c 2 ") + (P'f h ~ r x 2h ~ r + [p') 2 " x 2 " +r £ K[x] 
is identically zero, which, observing the degree of this polynomial and the fact that 
(r, 2k) = 1, we see is impossible unless /3 = f3 = 0. 

□ 

Remark 3 In fact this can also be readily seen by Lemma [T] by a simple comparison of 
coefficients. 

We now combine the results of Theorems [S] [|J] and Corollary [3] in the following 
statement. 

Corollary 3 The functions of Family^ are not CCZ-equivalent to the Gold functions. 

Acknowledgements We thank the referees whose comments led to a much better presenta- 
tion of this paper. 
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